Various Fixes and Behavioral Changes to the User Model

/to @bajtos @raymondfeng 
/cc @crandmck

## Background

These changes are the result of building the [LoopBack Access Control Example](https://github.com/strongloop/loopback-example-access-control). They included breaking changes in both api and behavior.

## Breaking API

The `User.login()` method used to take a `sid` parameter. This is legacy and needs to be replaced with `accessToken`. The `accessToken` is now retrieved directly from the remoting context. The downside to this, is that it doesn't fallback (AFAIK) to a passed parameter. Eg. `POST /api/users/logout?arg=val`. You can still use the API like this because the `accessToken` is populated from multiple places (params, headers).

## Behavioral Changes

Now the `User` model includes an opionated set of of ACLs that allow access where it makes sense for all applciations. See the diff for the exact ACLs. They are outlined below:

 - by default, deny all requests... prevents malicious use of the user api
 - allow everyone to create users (required for user registration)
 - allow the currently logged in user (owner) to delete themselves  
 - allow login and logout by default
 - allow the currently logged in user (owner) to read their own user object
 - allow the currently logged in user (owner) to update their own user object

## Tests

This patch also pulls in ~ 75 tests from the [LoopBack Access Control Example](https://github.com/strongloop/loopback-example-access-control).

## Version

This should be released as a minor revision. Most likely **1.4.0**.